BreachForums Gets Bent Over Yet Again! Maybe

In a significant blow to the cybercrime world, U.S. law enforcement has seized the clear web domain of the notorious BreachForums for the second time within a year. The latest version of the infamous Breached hacking forum, hosted at BreachForums[.]st, now displays a seizure banner from the FBI and the U.S. Department of Justice, with international assistance.

Authorities from across the globe, including the Australian Federal Police, the U.K. National Crime Agency, New Zealand Police, and the police department of Zürich in Switzerland, collaborated on this major takedown. Icelandic Police were also involved, demonstrating the extensive international effort.

Unconventionally, the seizure banner not only displays the site's logo but also features avatars of the forum's administrators, known as 'Baphomet' and 'ShinyHunters,' depicted behind bars.

The banner reads, 'We are reviewing this site’s backend data. If you have information to report about cybercriminal activity on BreachForums, please contact us.' It also provides a link to a form hosted on the Internet Crime Complaint Center for those with information that could assist in the ongoing investigations.

A summary on the portal details the operations of BreachForums and its predecessors. Since June 2023, BreachForums v2, run by 'ShinyHunters,' operated as a clear-net marketplace for cybercriminals to buy, sell, and trade contraband. This included stolen access devices, identification means, hacking tools, breached databases, and other illegal services.

Earlier versions of BreachForums, particularly the one hosted at breached.vc/.to/.co and operated by 'pompompurin' between March 2022 and June 2023, faced similar takedowns. The predecessor to both versions, Raidforums, run by 'Omnipotent,' was active from early 2015 until February 2022.

In a further move, the Telegram channel of 'Baphomet,' one of the key administrators, has also been seized, as confirmed by a pinned message from law enforcement on the channel.

The DOJ and FBI have yet to comment on the matter, and the presence of spelling mistakes in the notice casts doubt on its authenticity.